2019.11.26 - CSS DRAFT Statement of Objectives.docx

STATEMENT OF OBJECTIVES

Independent Customer Satisfaction Survey Service

I. INTRODUCTION

The Department of Defense (DoD) is in the process of transforming the way it moves personal property. The purpose of this Statement of Objectives (SOO) is to seek an independent company to send a Customer Satisfaction Survey (CSS) in four (4) stages to all DoD customers whose shipment/s have been processed and moved under a Global Household Good Contact (GHC). The results from the CSSs will be used to assist the Government in evaluating the contractor who processed, moved the DoD customers property. Currently the Department of Defense (DoD) solicits feedback from customers who have recently moved their personal property via the CSS. Today the DoD moves and or stores approximately 430K shipments annually. The CSS is used to as a mechanism to provide the DoD with the level of performance Transportation Service Providers (TSPs) provided their customers. Customers use a Web-based survey to provide feedback on each of their delivered shipments. The customers are provided access to the survey and instructed to complete a survey for each shipment. The Defense Personal Property System (DPS) flags each shipment indicating delivery and automatically sends reminder survey notifications to the customers. The survey contains validation messages to ensure customers’ rate their responses and review the survey score calculations based on their responses. DPS also warns customers that survey changes cannot be made after the survey has been submitted. All customers are sent their first e-mail reminder seven (7) calendar days after their shipment/s have been marked as delivered in DPS. Additional e-mail reminders are sent on the 14th and 21st calendar days after shipment delivery if the customer has not completed the Web survey. The customer is reminded of the importance of completing the survey. DPS uses the e-mail address obtained during counseling at origin or the most recent e-mail address provided by the customer. DPS indicates the shipment on which the survey is to be completed by identifying shipment-unique indicators (e.g., shipment origin/destination, date of pack/pickup/delivery, TSP name, weight and type of shipment [i.e., dHHG = Domestic Household Goods, iHHG = International Household Goods, or iUB = International Unaccompanied Baggage], and bill of lading [BL] number). Results from the CSS are considered the TSP’s performance score which is used as part of a calculation to establish a Best Value Score (BVS) for each TSP. Shipments are then distributed based on each TSPs BVS.

II. SCOPE

Customer Satisfaction Surveys will be sent to DoD customers whose shipment request(s) were coordinated with a single source Contractor from initial contact, through shipment pack and pickup, to delivery and the filing of a claim (if applicable). The CSS’s will need to be sent (text/email) at certain stages throughout the moving process. The data will be collected and provided to the Government for analysis monthly or upon request.

III. TASK OBJECTIVES STATEMENT

1. Receive automated notice a Government Information Technology system indicating the need to solicit and capture data on the customers complete move experience.

2. Initiate the applicable CSS on all identified customers who processed, moved, or had their personal property placed in storage via the GHC contractor.

3. Use the most economical and efficient method of obtaining customer feedback in order to meet or exceed target response rates.

4. Employ a system that is intuitive for customers, protects any and all Personally Identifiable Information (PII) of customers, and possesses the capability to generate monthly and ad hoc reports for program review and process improvement as well as input into the Government IT system.

5. Provide CSS data to a Government Data Warehouse in sufficient detail to associate the survey to the shipment and phase. Example data might include the Unique ID for each shipment, Survey Type (e.g., counseling), Survey Score, Date Requested, Date Replied, Comments, etc.

IV. REQUIREMENTS

Surveys must be sent for ALL shipments that have been processed (i.e., packed, picked up, and delivered) to DoD customers, unless specifically identified (See NOTE). Surveys must also be completed for shipment going into and being delivered out of Non-Temporary Storage (NTS) also known as long-term storage. The Government will provide relevant information on when each CSS needs to be sent and to whom (text/email address) the CSS needs to go to. The Government will phase in the number of CSSs that will be sent with a projected start date of February 2021 and culminating by January 2022 (See Attachment 2 for phased in projected CSS numbers, and Attachment 3 for Projected Future CSS totals).

NOTE: CSS data is not collected on shipments marked as BLUEBARK (Shipments for deceased individuals). The Government will not send data to the contractor on these types of shipments.

V. DELIVERABLES

Contractor shall perform provide the identified deliverables below. The Contractor shall send each customer a series of CSSs (each customer could have multiple shipments so a separate series of CSSs will be required for each shipment). The government will provide the CSS questions to the contractor. The Government IT system will notify the contractor when each CSS is required to be sent. Each CSS will be sent in stages with each stage identified as Pre- Move Services, Physical Move Services, and Post Move Services (See Attachment 4 for projected triggers and deliver methods). The contractor shall provide the Government reports monthly via email that identify the number of CSS’s sent, and the results of each survey returned.

Send Customer Satisfaction Surveys

Customer

VI. TYPE OF ORDER

The Government anticipates award of a Firm Fixed Price (FFP) contract.

VII. PERIOD OF PERFORMANCE

The period of performance shall be for three (3) base periods of 12 months each and up to two (2) option periods of twelve months each. The Government reserves the right to terminate this contract at any time.

VIII. PLACE OF PERFORMACE

The primary places of performance will be the contractor’s facility.

IX. GOVERNMENT FURNISHED PROPERTY/INFORMATION

The Government will provide the Customer Satisfaction Survey questions and applicable stages (See attachment 1) for when each will be sent to each customer.

The Government will provide the necessary data that will act as a trigger to the contractor to send each CSS.

X. CONTRACTING OFFICER’S REPRESENTATIVE AND TASK MANAGER

This contract will be monitored by a government representative; that individual will be designated and appointed prior to award. The contract may also be monitored by one or more COTRs; these individuals may be assigned after award by USTC to provide technical insight into performance.

XI. SECURITY REQUIREMENTS

The Contractor will be fed information from a third party system that identifies when each CSS is to be sent.

XII. CYBER SECURITY

Handling and Protection of Non-Public Information. In performance of this contract, the contractor may have access to DoD Information which for the purposes of this section shall mean any information developed or received in the course of planning, providing storage services and invoicing in support of the requirements of this contract. To adequately protect this information, contractor information systems (IS) involved in the performance of this contract shall comply with the security requirements in the current version of the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations,” as soon as practical but no later than the first day orders may be issued as detailed in clause 52.216-18 Ordering. The contractor agrees (a) to use and protect such information from unauthorized disclosure law DoD Instruction 8582.01: Security of Unclassified DoD Information on Non-DoD Information Systems; (b) to use and disclose such information only for the purpose of performing this contract and to not use or disclose such information for any personal or commercial purpose; (c) to comply with other current Federal and DoD information protection and reporting requirements for specified categories of information (e.g. , medical, proprietary, critical program information (CPI), personally identifiable information, export controlled); (d) to obtain permission of the Government Program Manager before disclosing/discussing such information with a third party; (e) to return and/or electronically purge, upon Government request, any DoD information no longer required for contractor performance; and (f) to advise the CO and/or COR of any unauthorized release of such information.

Operationally Critical Support. The services designated under this contract are “operationally critical support” as defined in DFARS 252.204-7012 Safeguarding Covered Defense Information and Cyber Incident Reporting.

PII/Security, Covered Defense Information. The contractor will have access to Covered Defense Information (CDI) in the form of "other information" as defined in DFARS 252.204-7012 and described in the Controlled Unclassified Information (CUI) Registry at http://www.archives.gov/cui/registry/category-list.html. The CDI requiring safeguarding or dissemination controls is as follows:

Customer relocation orders/task orders which contain Personally Identifiable Information (PII);

Reserved for any other items provided to, or generated by the contractor (such as reports) that meet the definition of PII/CDI.

Cyber Security Assessments and Mitigation Plans. The contractor shall provide a Self-Assessment of its compliance with NIST SP 800-171 and present a Plan of Action that identifies any deviations, non-compliance, or proposed alternative means of compliance as well as plans for correcting non-compliant requirements to the contracting officer on TBD @ this time and then annually thereafter. The Self- Assessment and Plan of Action shall address all of the requirements in NIST SP 800-171. The table in (Appendix E) provides modified requirements of CUI/CDI specific controls from NIST SP 800-171 that will be used to evaluate compliance in a non-CUI/CDI environment. Additionally, at any time during the period of performance, when a contractor determines it is non-compliant with a NIST SP 800-171 requirement or an approved alternate means of compliance resulting in a High or Moderate Potential Impact as defined in Federal Information Processing Standards Publication (FIPS PUB) 199, “Standards for Security Categorization of Federal Information and Information Systems,” the contractor shall submit a Plan of Action within 15 days of the determination of non-compliance.

Plans of Action and any requests to vary from NIST SP 800-171 shall be submitted to the contracting officer for consideration and approval by USTRANSCOM. The contractor need not implement any security requirement determined by USTRANSCOM to be non-applicable or to have an equally effective alternative security measure implemented in its place. The Plan of Action shall follow the template provided in (Appendix F). Alternate formats for the Plan of Action may be proposed and must be approved by USTRANSCOM.

USTRANSCOM may conduct an on-site visit to a contractor's facility or request a third party assessment (U.S. Government agency or U.S. Government funded commercial entity) to review progress towards meeting their Plan of Action, evaluate any proposed variances to NIST SP 800-171 requirements resulting from the non-compliance. Date and time of on-site visits will be mutually agreed-upon by USTRANSCOM and the contractor in advance.

Cyber Incident Reporting. When the contractor discovers a cyber incident, as defined in DFARS Clause 252.204-7012, or when notified by federal, state or local law enforcement, that affects the contractor’s ability to perform the operationally critical support as identified in the contract, the contractor shall, as soon as practicable, but no later than 72 hours after discovering the incident, notify the USTRANSCOM Deployment and Distribution Operations Center (DDOC) Chief at 618-220-7700. If the contractor does not immediately reach the DDOC Chief via phone, the contractor shall send a notification email to transcom.scott.tcj3.mbx.ddoc-chief@mail.mil. The contractor shall provide an initial description of the incident that will include the information known at the time of the notification and shall provide a company POC who shall work with USTRANSCOM DDOC through the resolution of the incident.

The contractor shall also report the incident as outlined in DFARS 252.204-7012.

USTRANSCOM may conduct an on-site review to assist the contractor in evaluating the extent of the incident and to share information in an effort to minimize the impact to both parties. Date and time of on-site visits will be mutually agreed-upon by USTRANSCOM and the contractor in advance.

Security Regulation Guidance that might apply:

DoD: (DoD issuances found at: http://www.dtic.mil/whs/directives/corres/pub1.html):

• O-2000.16 (DODI Antiterrorism (AT) Standards), Vol 1, 17 November 2016

• DoD 5200.02,, Personnel Security Program, 17 April 2017

• DoD 5200.08-R, Change-1, DoD Physical Security Program, May 27, 2009

• DoDO 2000.16, DoD Antiterrorism (AT) Standards, Vol. 1, November 17, 2016

• DODI 1000.13 DoD ID Card Lifecycle, (Dated Jan 2013, Vol. 1).

• DoDI 5200.02 DODM Procedures for the DOD Personnel Security Program

• DoDI 5220.22, National Industrial Security Program Operating Manual (NISPOM), 18 May 2016

• DoDI 8500.01, Cybersecurity, March 13, 2014

• DoDI 8510.01, DoD Information Assurance Certification and Accreditation Process (DIACAP), November 28, 2007

• DoDI 8582.01, Security of Unclassified DoD Information on Non-DoD Systems, June 6, 2012

• DoDM 5200.01 VOL. 1, DoD Information Security Program: Overview, Classification, and Declassification, 24 February 2012

• DoDM 5200.01 VOL. 2, DoD Information Security Program: Marking of Classified Information Summary of Changes, CH 2, 19 March 2013

• DoDM 5200.01 VOL. 3, DoD Information Security Program: Protection of Classified Information Summary of Changes, CH 2, 19 March 2013

• DoDM 5200.01 VOL. 4, 2/24/2012 DoD Information Security Program: Controlled Unclassified Information (CUI) Summary of Changes, 24 February 2012

• DTM 08-027, Change-1, Security of Unclassified DoD Information on Non-DoD Information Systems, September 16, 2010

• NIST SP 800-18, Guide for Developing Security Plans for Federal Information Systems, February 2006

• NIST SP 800-30, Guide for Conducting Risk Assessments, September 2012

• NIST SP 800-37, Guide for Applying the Risk Management Framework to Federal Information, 5 June 2014

• CJCSM 3213.02D, Joint Staff Alternative Compensatory Control Measures (ACCM) Program Management Manual (Limited Distribution).

USTRANSCOM:

• USTRANSCOM Instruction 31-02, USTRANSCOM Security Classification Guide, 9 October 2015

• USTRANSCOM Instruction 31-12, USTRANSCOM Operations Security – OPSEC, 19 February 15

FORMS:

• FD Form 258, fingerprint Card.

DoD publications, directives, and instructions listed above are available at:

http://www.dtic.mil/whs/directives/corres/pub1.htm

NOTE TO THE PRIME CONTRACTOR FACILITY SECURITY OFFICER (FSO):

The prime contractor will forward the name, address, email address and telephone number of the Company FSO and backup to the USTRANSCOM Protection Programs Division TCJ3-MP to:

steven.m.strait@mail.mil and steven.g.stegen.civ@mail.mil USTRANSCOM Protection Programs Division (Industrial Security) Points of Contact:

USTRANSCOM

Attn: TCJ3-MP (Steve Strait or Steve Stegen) 508 Scott Drive Scott AFB IL 62225 Commercial: 618-220-6531/220-7892 (respectively)

USTCJ3-MP Approval: Steven M. Strait, USTRANSCOM (Protections Programs Branch) USTCJ3- MP Tracking #: USTRANSCOM-MP-0088-19

Attachments:

1. List of Potential CSS Questions and Stages

2. Projected Phased in CSS totals

3. Projected Future CSS totals

4. Visual Representation